« Volver al listado

CVE-2024-36518

Estado: AnalizadaMedia (5.4)—

Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in attack surface analyzer's dashboard.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Zohocorp — Manageengine Adaudit Plus

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-36518",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-36518",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-15T00:00:00+00:00"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.3,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.5,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
      "affectedData": [
        {
          "vendor": "ManageEngine",
          "product": "ADAudit Plus",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "8110",
              "lessThanOrEqual": "8110"
            }
          ],
          "platforms": [
            "Windows"
          ],
          "collectionURL": "https://www.manageengine.com/products/active-directory-audit/download.html",
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:manageengine:adaudit_plus:*:*:*:*:*:*:*:*"
          ],
          "vendor": "manageengine",
          "product": "adaudit_plus",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "8110",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-08-12T13:38:22.620",
  "references": [
    {
      "url": "https://www.manageengine.com/products/active-directory-audit/cve-2024-36518.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in attack surface analyzer's dashboard."
    },
    {
      "lang": "es",
      "value": "Las versiones de Zohocorp ManageEngine ADAudit Plus inferiores a 8110 son vulnerables a la inyección SQL autenticada en el panel del analizador de superficie de ataque."
    }
  ],
  "lastModified": "2026-06-17T07:36:53.297",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_adaudit_plus:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7B10BA6C-6B3E-4A00-BBFF-9F2F184852AD",
              "versionEndExcluding": "8.1"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_adaudit_plus:8.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C6086C7D-31EA-493A-9E0A-6E0DA21B486E"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_adaudit_plus:8.1:8100:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E7AB1D57-468B-47C1-ABB7-EAD95DA47212"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "0fc0942c-577d-436f-ae8e-945763c79b02"
}